CVE-2021-47704

Medium · 6.5

CVSS

6.5

EPSS

0.4%

Published

Dec 9, 2025

CISA due date

—

The record

OpenBMCS 2.4 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting arbitrary SQL code. Attackers can send GET requests to /debug/obix_test.php with malicious 'id' values to extract database information.

Affected packages

Ecosystem	Package	Introduced	Fixed